Merge tag 'for-linus-20180623' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe: - Further timeout fixes. We aren't quite there yet, so expect another round of fixes for that to completely close some of the IRQ vs completion races. (Christoph/Bart) - Set of NVMe fixes from the usual suspects, mostly error handling - Two off-by-one fixes (Dan) - Another bdi race fix (Jan) - Fix nbd reconfigure with NBD_DISCONNECT_ON_CLOSE (Doron) * tag 'for-linus-20180623' of git://git.kernel.dk/linux-block: blk-mq: Fix timeout handling in case the timeout handler returns BLK_EH_DONE bdi: Fix another oops in wb_workfn() lightnvm: Remove depends on HAS_DMA in case of platform dependency nvme-pci: limit max IO size and segments to avoid high order allocations nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl nvme-fc: release io queues to allow fast fail nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag. block: sed-opal: Fix a couple off by one bugs blk-mq-debugfs: Off by one in blk_mq_rq_state_name() nvmet: reset keep alive timer in controller enable nvme-rdma: don't override opts->queue_size nvme-rdma: Fix command completion race at error recovery nvme-rdma: fix possible free of a non-allocated async event buffer nvme-rdma: fix possible double free condition when failing to create a controller Revert "block: Add warning for bi_next not NULL in bio_endio()" block: fix timeout changes for legacy request drivers

Linus Torvalds committed 8 years ago

Commit 77072ca2 parents 2dd3f7c f5e350f20 files · +142 −84Browse files

Unified · Split

20 files

block/bio.c +0 −3
block/blk-core.c +1 −7
block/blk-mq-debugfs.c +1 −1
block/blk-mq.c +0 −1
block/blk-softirq.c +1 −0
block/blk-timeout.c +1 −0
block/sed-opal.c +2 −2
drivers/block/nbd.c +34 −8
drivers/block/null_blk.c +1 −1
drivers/lightnvm/Kconfig +1 −1
drivers/nvme/host/core.c +1 −0
drivers/nvme/host/fc.c +3 −3
drivers/nvme/host/nvme.h +1 −0
drivers/nvme/host/pci.c +38 −6
drivers/nvme/host/rdma.c +37 −36
drivers/nvme/target/core.c +8 −0
drivers/scsi/scsi_transport_fc.c +1 −1
include/linux/backing-dev-defs.h +1 −1
include/uapi/linux/nbd.h +3 −0
mm/backing-dev.c +7 −13

block/bio.c+0−3

@@ -1807,9 +1807,6 @@ again: · 1806 unmodified lines
1807	if (!bio_integrity_endio(bio))	1807	if (!bio_integrity_endio(bio))
1808	return;	1808	return;
1809		1809
1810	if (WARN_ONCE(bio->bi_next, "driver left bi_next not NULL"))
1811	bio->bi_next = NULL;
1812
1813	/*	1810	/*
1814	* Need to have a real endio function for chained bios, otherwise	1811	* Need to have a real endio function for chained bios, otherwise
1815	* various corner cases will break (like stacking block devices that	1812	* various corner cases will break (like stacking block devices that

block/blk-core.c+1−7

 	bio_advance(bio, nbytes);
 	/* don't actually finish bio if it's part of flush sequence */
-	/*
-	 * XXX this code looks suspicious - it's not consistent with advancing
-	 * req->bio in caller
-	 */
 	if (bio->bi_iter.bi_size == 0 && !(rq->rq_flags & RQF_FLUSH_SEQ))
 		bio_endio(bio);
 }
 		struct bio *bio = req->bio;
 		unsigned bio_bytes = min(bio->bi_iter.bi_size, nr_bytes);
-		if (bio_bytes == bio->bi_iter.bi_size) {
+		if (bio_bytes == bio->bi_iter.bi_size)
 			req->bio = bio->bi_next;
-			bio->bi_next = NULL;
-		}
 		/* Completion has already been traced */
 		bio_clear_flag(bio, BIO_TRACE_COMPLETION);

block/blk-mq-debugfs.c+1−1

@@ -356,7 +356,7 @@ static const char *const blk_mq_rq_state_name_array[] = { · 355 unmodified lines
356		356
357	static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)	357	static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
358	{	358	{
359	if (WARN_ON_ONCE((unsigned int)rq_state >	359	if (WARN_ON_ONCE((unsigned int)rq_state >=
360	ARRAY_SIZE(blk_mq_rq_state_name_array)))	360	ARRAY_SIZE(blk_mq_rq_state_name_array)))
361	return "(?)";	361	return "(?)";
362	return blk_mq_rq_state_name_array[rq_state];	362	return blk_mq_rq_state_name_array[rq_state];

block/blk-mq.c+0−1

@@ -781,7 +781,6 @@ static void blk_mq_rq_timed_out(struct request *req, bool reserved) · 780 unmodified lines
781	WARN_ON_ONCE(ret != BLK_EH_RESET_TIMER);	781	WARN_ON_ONCE(ret != BLK_EH_RESET_TIMER);
782	}	782	}
783		783
784	req->rq_flags &= ~RQF_TIMED_OUT;
785	blk_add_timer(req);	784	blk_add_timer(req);
786	}	785	}
787		786

block/blk-softirq.c+1−0

@@ -144,6 +144,7 @@ do_local: · 143 unmodified lines
144		144
145	local_irq_restore(flags);	145	local_irq_restore(flags);
146	}	146	}
		147	EXPORT_SYMBOL(__blk_complete_request);
147		148
148	/**	149	/**
149	* blk_complete_request - end I/O on a request	150	* blk_complete_request - end I/O on a request

block/blk-timeout.c+1−0

@@ -210,6 +210,7 @@ void blk_add_timer(struct request *req) · 209 unmodified lines
210	if (!req->timeout)	210	if (!req->timeout)
211	req->timeout = q->rq_timeout;	211	req->timeout = q->rq_timeout;
212		212
		213	req->rq_flags &= ~RQF_TIMED_OUT;
213	blk_rq_set_deadline(req, jiffies + req->timeout);	214	blk_rq_set_deadline(req, jiffies + req->timeout);
214		215
215	/*	216	/*

block/sed-opal.c+2−2

@@ -877,7 +877,7 @@ static size_t response_get_string(const struct parsed_resp *resp, int n, · 876 unmodified lines
877	return 0;	877	return 0;
878	}	878	}
879		879
880	if (n > resp->num) {	880	if (n >= resp->num) {
881	pr_debug("Response has %d tokens. Can't access %d\n",	881	pr_debug("Response has %d tokens. Can't access %d\n",
882	resp->num, n);	882	resp->num, n);
883	return 0;	883	return 0;
@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct parsed_resp *resp, int n) · 32 unmodified lines
916	return 0;	916	return 0;
917	}	917	}
918		918
919	if (n > resp->num) {	919	if (n >= resp->num) {
920	pr_debug("Response has %d tokens. Can't access %d\n",	920	pr_debug("Response has %d tokens. Can't access %d\n",
921	resp->num, n);	921	resp->num, n);
922	return 0;	922	return 0;

drivers/block/nbd.c+34−8

 #define NBD_HAS_CONFIG_REF		4
 #define NBD_BOUND			5
 #define NBD_DESTROY_ON_DISCONNECT	6
+#define NBD_DISCONNECT_ON_CLOSE 	7
 struct nbd_config {
 	u32 flags;
 static void nbd_connect_reply(struct genl_info *info, int index);
 static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
 static void nbd_dead_link_work(struct work_struct *work);
+static void nbd_disconnect_and_put(struct nbd_device *nbd);
 static inline struct device *nbd_to_dev(struct nbd_device *nbd)
 {
 static void nbd_release(struct gendisk *disk, fmode_t mode)
 {
 	struct nbd_device *nbd = disk->private_data;
+	struct block_device *bdev = bdget_disk(disk, 0);
+	if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
+			bdev->bd_openers == 0)
+		nbd_disconnect_and_put(nbd);
 	nbd_config_put(nbd);
 	nbd_put(nbd);
 }
 				&config->runtime_flags);
 			put_dev = true;
 		}
+		if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+			set_bit(NBD_DISCONNECT_ON_CLOSE,
+				&config->runtime_flags);
+		}
 	}
 	if (info->attrs[NBD_ATTR_SOCKETS]) {
 	return ret;
 }
+static void nbd_disconnect_and_put(struct nbd_device *nbd)
+{
+	mutex_lock(&nbd->config_lock);
+	nbd_disconnect(nbd);
+	nbd_clear_sock(nbd);
+	mutex_unlock(&nbd->config_lock);
+	if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+			       &nbd->config->runtime_flags))
+		nbd_config_put(nbd);
+}
 static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nbd_device *nbd;
 		nbd_put(nbd);
 		return 0;
 	}
-	mutex_lock(&nbd->config_lock);
+	nbd_disconnect_and_put(nbd);
-	nbd_disconnect(nbd);
-	nbd_clear_sock(nbd);
-	mutex_unlock(&nbd->config_lock);
-	if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
-			       &nbd->config->runtime_flags))
-		nbd_config_put(nbd);
 	nbd_config_put(nbd);
 	nbd_put(nbd);
 	return 0;
 	struct nbd_device *nbd = NULL;
 	struct nbd_config *config;
 	int index;
-	int ret = -EINVAL;
+	int ret = 0;
 	bool put_dev = false;
 	if (!netlink_capable(skb, CAP_SYS_ADMIN))
 	    !nbd->task_recv) {
 		dev_err(nbd_to_dev(nbd),
 			"not configured, cannot reconfigure\n");
+		ret = -EINVAL;
 		goto out;
 	}
 					       &config->runtime_flags))
 				refcount_inc(&nbd->refs);
 		}
+		if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+			set_bit(NBD_DISCONNECT_ON_CLOSE,
+					&config->runtime_flags);
+		} else {
+			clear_bit(NBD_DISCONNECT_ON_CLOSE,
+					&config->runtime_flags);
+		}
 	}
 	if (info->attrs[NBD_ATTR_SOCKETS]) {

drivers/block/null_blk.c+1−1

@@ -1365,7 +1365,7 @@ static blk_qc_t null_queue_bio(struct request_queue q, struct bio bio) · 1364 unmodified lines
1365	static enum blk_eh_timer_return null_rq_timed_out_fn(struct request *rq)	1365	static enum blk_eh_timer_return null_rq_timed_out_fn(struct request *rq)
1366	{	1366	{
1367	pr_info("null: rq %p timed out\n", rq);	1367	pr_info("null: rq %p timed out\n", rq);
1368	blk_mq_complete_request(rq);	1368	__blk_complete_request(rq);
1369	return BLK_EH_DONE;	1369	return BLK_EH_DONE;
1370	}	1370	}
1371		1371

drivers/lightnvm/Kconfig+1−1

@@ -4,7 +4,7 @@ · 3 unmodified lines
4		4
5	menuconfig NVM	5	menuconfig NVM
6	bool "Open-Channel SSD target support"	6	bool "Open-Channel SSD target support"
7	depends on BLOCK && HAS_DMA && PCI	7	depends on BLOCK && PCI
8	select BLK_DEV_NVME	8	select BLK_DEV_NVME
9	help	9	help
10	Say Y here to get to enable Open-channel SSDs.	10	Say Y here to get to enable Open-channel SSDs.

drivers/nvme/host/core.c+1−0

@@ -1808,6 +1808,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl, · 1807 unmodified lines
1808	u32 max_segments =	1808	u32 max_segments =
1809	(ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1;	1809	(ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1;
1810		1810
		1811	max_segments = min_not_zero(max_segments, ctrl->max_segments);
1811	blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);	1812	blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
1812	blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));	1813	blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
1813	}	1814	}

drivers/nvme/host/fc.c+3−3

 	/* re-enable the admin_q so anything new can fast fail */
 	blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+	/* resume the io queues so that things will fast fail */
+	nvme_start_queues(&ctrl->ctrl);
 	nvme_fc_ctlr_inactive_on_rport(ctrl);
 }
 	 * waiting for io to terminate
 	 */
 	nvme_fc_delete_association(ctrl);
-	/* resume the io queues so that things will fast fail */
-	nvme_start_queues(nctrl);
 }
 static void

drivers/nvme/host/nvme.h+1−0

@@ -170,6 +170,7 @@ struct nvme_ctrl { · 169 unmodified lines
170	u64 cap;	170	u64 cap;
171	u32 page_size;	171	u32 page_size;
172	u32 max_hw_sectors;	172	u32 max_hw_sectors;
		173	u32 max_segments;
173	u16 oncs;	174	u16 oncs;
174	u16 oacs;	175	u16 oacs;
175	u16 nssa;	176	u16 nssa;

drivers/nvme/host/pci.c+38−6

 #define SGES_PER_PAGE	(PAGE_SIZE / sizeof(struct nvme_sgl_desc))
+/*
+ * These can be higher, but we need to ensure that any command doesn't
+ * require an sg allocation that needs more than a page of data.
+ */
+#define NVME_MAX_KB_SZ	4096
+#define NVME_MAX_SEGS	127
 static int use_threaded_interrupts;
 module_param(use_threaded_interrupts, int, 0);
 	struct nvme_ctrl ctrl;
 	struct completion ioq_wait;
+	mempool_t *iod_mempool;
 	/* shadow doorbell buffer support: */
 	u32 *dbbuf_dbs;
 	dma_addr_t dbbuf_dbs_dma_addr;
 	iod->use_sgl = nvme_pci_use_sgls(dev, rq);
 	if (nseg > NVME_INT_PAGES || size > NVME_INT_BYTES(dev)) {
-		size_t alloc_size = nvme_pci_iod_alloc_size(dev, size, nseg,
+		iod->sg = mempool_alloc(dev->iod_mempool, GFP_ATOMIC);
-				iod->use_sgl);
-		iod->sg = kmalloc(alloc_size, GFP_ATOMIC);
 		if (!iod->sg)
 			return BLK_STS_RESOURCE;
 	} else {
 	}
 	if (iod->sg != iod->inline_sg)
-		kfree(iod->sg);
+		mempool_free(iod->sg, dev->iod_mempool);
 }
 #ifdef CONFIG_BLK_DEV_INTEGRITY
 		blk_put_queue(dev->ctrl.admin_q);
 	kfree(dev->queues);
 	free_opal_dev(dev->ctrl.opal_dev);
+	mempool_destroy(dev->iod_mempool);
 	kfree(dev);
 }
 	nvme_get_ctrl(&dev->ctrl);
 	nvme_dev_disable(dev, false);
+	nvme_kill_queues(&dev->ctrl);
 	if (!queue_work(nvme_wq, &dev->remove_work))
 		nvme_put_ctrl(&dev->ctrl);
 }
 	if (result)
 		goto out;
+	/*
+	 * Limit the max command size to prevent iod->sg allocations going
+	 * over a single page.
+	 */
+	dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1;
+	dev->ctrl.max_segments = NVME_MAX_SEGS;
 	result = nvme_init_identify(&dev->ctrl);
 	if (result)
 		goto out;
 	struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
-	nvme_kill_queues(&dev->ctrl);
 	if (pci_get_drvdata(pdev))
 		device_release_driver(&pdev->dev);
 	nvme_put_ctrl(&dev->ctrl);
 	int node, result = -ENOMEM;
 	struct nvme_dev *dev;
 	unsigned long quirks = id->driver_data;
+	size_t alloc_size;
 	node = dev_to_node(&pdev->dev);
 	if (node == NUMA_NO_NODE)
 	if (result)
 		goto release_pools;
+	/*
+	 * Double check that our mempool alloc size will cover the biggest
+	 * command we support.
+	 */
+	alloc_size = nvme_pci_iod_alloc_size(dev, NVME_MAX_KB_SZ,
+						NVME_MAX_SEGS, true);
+	WARN_ON_ONCE(alloc_size > PAGE_SIZE);
+	dev->iod_mempool = mempool_create_node(1, mempool_kmalloc,
+						mempool_kfree,
+						(void *) alloc_size,
+						GFP_KERNEL, node);
+	if (!dev->iod_mempool) {
+		result = -ENOMEM;
+		goto release_pools;
+	}
 	dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 	nvme_get_ctrl(&dev->ctrl);

drivers/nvme/host/rdma.c+37−36

 	if (!test_and_clear_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
 		return;
-	if (nvme_rdma_queue_idx(queue) == 0) {
-		nvme_rdma_free_qe(queue->device->dev,
-			&queue->ctrl->async_event_sqe,
-			sizeof(struct nvme_command), DMA_TO_DEVICE);
-	}
 	nvme_rdma_destroy_queue_ib(queue);
 	rdma_destroy_id(queue->cm_id);
 }
 		set = &ctrl->tag_set;
 		memset(set, 0, sizeof(*set));
 		set->ops = &nvme_rdma_mq_ops;
-		set->queue_depth = nctrl->opts->queue_size;
+		set->queue_depth = nctrl->sqsize + 1;
 		set->reserved_tags = 1; /* fabric connect */
 		set->numa_node = NUMA_NO_NODE;
 		set->flags = BLK_MQ_F_SHOULD_MERGE;
 static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
 		bool remove)
 {
-	nvme_rdma_stop_queue(&ctrl->queues[0]);
 	if (remove) {
 		blk_cleanup_queue(ctrl->ctrl.admin_q);
 		nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
 	}
+	nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+		sizeof(struct nvme_command), DMA_TO_DEVICE);
 	nvme_rdma_free_queue(&ctrl->queues[0]);
 }
 	ctrl->max_fr_pages = nvme_rdma_get_max_fr_pages(ctrl->device->dev);
+	error = nvme_rdma_alloc_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+			sizeof(struct nvme_command), DMA_TO_DEVICE);
+	if (error)
+		goto out_free_queue;
 	if (new) {
 		ctrl->ctrl.admin_tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, true);
 		if (IS_ERR(ctrl->ctrl.admin_tagset)) {
 			error = PTR_ERR(ctrl->ctrl.admin_tagset);
-			goto out_free_queue;
+			goto out_free_async_qe;
 		}
 		ctrl->ctrl.admin_q = blk_mq_init_queue(&ctrl->admin_tag_set);
 	if (error)
 		goto out_stop_queue;
-	error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev,
-			&ctrl->async_event_sqe, sizeof(struct nvme_command),
-			DMA_TO_DEVICE);
-	if (error)
-		goto out_stop_queue;
 	return 0;
 out_stop_queue:
 out_free_tagset:
 	if (new)
 		nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+out_free_async_qe:
+	nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+		sizeof(struct nvme_command), DMA_TO_DEVICE);
 out_free_queue:
 	nvme_rdma_free_queue(&ctrl->queues[0]);
 	return error;
 static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl,
 		bool remove)
 {
-	nvme_rdma_stop_io_queues(ctrl);
 	if (remove) {
 		blk_cleanup_queue(ctrl->ctrl.connect_q);
 		nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset);
 	list_del(&ctrl->list);
 	mutex_unlock(&nvme_rdma_ctrl_mutex);
-	kfree(ctrl->queues);
 	nvmf_free_options(nctrl->opts);
 free_ctrl:
+	kfree(ctrl->queues);
 	kfree(ctrl);
 }
 	return;
 destroy_admin:
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 	nvme_rdma_destroy_admin_queue(ctrl, false);
 requeue:
 	dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
 	if (ctrl->ctrl.queue_count > 1) {
 		nvme_stop_queues(&ctrl->ctrl);
+		nvme_rdma_stop_io_queues(ctrl);
 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
 					nvme_cancel_request, &ctrl->ctrl);
 		nvme_rdma_destroy_io_queues(ctrl, false);
 	}
 	blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 	blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
 				nvme_cancel_request, &ctrl->ctrl);
 	nvme_rdma_destroy_admin_queue(ctrl, false);
 {
 	if (ctrl->ctrl.queue_count > 1) {
 		nvme_stop_queues(&ctrl->ctrl);
+		nvme_rdma_stop_io_queues(ctrl);
 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
 					nvme_cancel_request, &ctrl->ctrl);
 		nvme_rdma_destroy_io_queues(ctrl, shutdown);
 		nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
 	blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 	blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
 				nvme_cancel_request, &ctrl->ctrl);
 	blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
 		goto out_free_ctrl;
 	}
-	ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
-				0 /* no quirks, we're perfect! */);
-	if (ret)
-		goto out_free_ctrl;
 	INIT_DELAYED_WORK(&ctrl->reconnect_work,
 			nvme_rdma_reconnect_ctrl_work);
 	INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work);
 	ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues),
 				GFP_KERNEL);
 	if (!ctrl->queues)
-		goto out_uninit_ctrl;
+		goto out_free_ctrl;
+	ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
+				0 /* no quirks, we're perfect! */);
+	if (ret)
+		goto out_kfree_queues;
 	changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
 	WARN_ON_ONCE(!changed);
 	ret = nvme_rdma_configure_admin_queue(ctrl, true);
 	if (ret)
-		goto out_kfree_queues;
+		goto out_uninit_ctrl;
 	/* sanity check icdoff */
 	if (ctrl->ctrl.icdoff) {
 		goto out_remove_admin_queue;
 	}
-	if (opts->queue_size > ctrl->ctrl.maxcmd) {
+	/* only warn if argument is too large here, will clamp later */
-		/* warn if maxcmd is lower than queue_size */
-		dev_warn(ctrl->ctrl.device,
-			"queue_size %zu > ctrl maxcmd %u, clamping down\n",
-			opts->queue_size, ctrl->ctrl.maxcmd);
-		opts->queue_size = ctrl->ctrl.maxcmd;
-	}
 	if (opts->queue_size > ctrl->ctrl.sqsize + 1) {
-		/* warn if sqsize is lower than queue_size */
 		dev_warn(ctrl->ctrl.device,
 			"queue_size %zu > ctrl sqsize %u, clamping down\n",
 			opts->queue_size, ctrl->ctrl.sqsize + 1);
-		opts->queue_size = ctrl->ctrl.sqsize + 1;
+	}
+	/* warn if maxcmd is lower than sqsize+1 */
+	if (ctrl->ctrl.sqsize + 1 > ctrl->ctrl.maxcmd) {
+		dev_warn(ctrl->ctrl.device,
+			"sqsize %u > ctrl maxcmd %u, clamping down\n",
+			ctrl->ctrl.sqsize + 1, ctrl->ctrl.maxcmd);
+		ctrl->ctrl.sqsize = ctrl->ctrl.maxcmd - 1;
 	}
 	if (opts->nr_io_queues) {
 	return &ctrl->ctrl;
 out_remove_admin_queue:
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 	nvme_rdma_destroy_admin_queue(ctrl, true);
-out_kfree_queues:
-	kfree(ctrl->queues);
 out_uninit_ctrl:
 	nvme_uninit_ctrl(&ctrl->ctrl);
 	nvme_put_ctrl(&ctrl->ctrl);
 	if (ret > 0)
 		ret = -EIO;
 	return ERR_PTR(ret);
+out_kfree_queues:
+	kfree(ctrl->queues);
 out_free_ctrl:
 	kfree(ctrl);
 	return ERR_PTR(ret);

drivers/nvme/target/core.c+8−0

@@ -686,6 +686,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) · 685 unmodified lines
686	}	686	}
687		687
688	ctrl->csts = NVME_CSTS_RDY;	688	ctrl->csts = NVME_CSTS_RDY;
		689
		690	/*
		691	* Controllers that are not yet enabled should not really enforce the
		692	* keep alive timeout, but we still want to track a timeout and cleanup
		693	* in case a host died before it enabled the controller. Hence, simply
		694	* reset the keep alive timer when the controller is enabled.
		695	*/
		696	mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
689	}	697	}
690		698
691	static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)	699	static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)

drivers/scsi/scsi_transport_fc.c+1−1

@@ -3592,7 +3592,7 @@ fc_bsg_job_timeout(struct request *req) · 3591 unmodified lines
3592		3592
3593	/* the blk_end_sync_io() doesn't check the error */	3593	/* the blk_end_sync_io() doesn't check the error */
3594	if (inflight)	3594	if (inflight)
3595	blk_mq_complete_request(req);	3595	__blk_complete_request(req);
3596	return BLK_EH_DONE;	3596	return BLK_EH_DONE;
3597	}	3597	}
3598		3598

include/linux/backing-dev-defs.h+1−1

  */
 enum wb_state {
 	WB_registered,		/* bdi_register() was done */
-	WB_shutting_down,	/* wb_shutdown() in progress */
 	WB_writeback_running,	/* Writeback is in progress */
 	WB_has_dirty_io,	/* Dirty inodes on ->b_{dirty|io|more_io} */
 	WB_start_all,		/* nr_pages == 0 (all) work pending */
 #ifdef CONFIG_CGROUP_WRITEBACK
 	struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
 	struct rb_root cgwb_congested_tree; /* their congested states */
+	struct mutex cgwb_release_mutex;  /* protect shutdown of wb structs */
 #else
 	struct bdi_writeback_congested *wb_congested;
 #endif

include/uapi/linux/nbd.h+3−0

@@ -53,6 +53,9 @@ enum { · 52 unmodified lines
53	/* These are client behavior specific flags. */	53	/* These are client behavior specific flags. */
54	#define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on	54	#define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on
55	disconnect. */	55	disconnect. */
		56	#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on
		57	* close by last opener.
		58	*/
56		59
57	/* userspace doesn't need the nbd_device structure */	60	/* userspace doesn't need the nbd_device structure */
58		61

mm/backing-dev.c+7−13

 	spin_lock_bh(&wb->work_lock);
 	if (!test_and_clear_bit(WB_registered, &wb->state)) {
 		spin_unlock_bh(&wb->work_lock);
-		/*
-		 * Wait for wb shutdown to finish if someone else is just
-		 * running wb_shutdown(). Otherwise we could proceed to wb /
-		 * bdi destruction before wb_shutdown() is finished.
-		 */
-		wait_on_bit(&wb->state, WB_shutting_down, TASK_UNINTERRUPTIBLE);
 		return;
 	}
-	set_bit(WB_shutting_down, &wb->state);
 	spin_unlock_bh(&wb->work_lock);
 	cgwb_remove_from_bdi_list(wb);
 	mod_delayed_work(bdi_wq, &wb->dwork, 0);
 	flush_delayed_work(&wb->dwork);
 	WARN_ON(!list_empty(&wb->work_list));
-	/*
-	 * Make sure bit gets cleared after shutdown is finished. Matches with
-	 * the barrier provided by test_and_clear_bit() above.
-	 */
-	smp_wmb();
-	clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 static void wb_exit(struct bdi_writeback *wb)
 	struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
 						release_work);
+	mutex_lock(&wb->bdi->cgwb_release_mutex);
 	wb_shutdown(wb);
 	css_put(wb->memcg_css);
 	css_put(wb->blkcg_css);
+	mutex_unlock(&wb->bdi->cgwb_release_mutex);
 	fprop_local_destroy_percpu(&wb->memcg_completions);
 	percpu_ref_exit(&wb->refcnt);
 	INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
 	bdi->cgwb_congested_tree = RB_ROOT;
+	mutex_init(&bdi->cgwb_release_mutex);
 	ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
 	if (!ret) {
 	spin_lock_irq(&cgwb_lock);
 	radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
 		cgwb_kill(*slot);
+	spin_unlock_irq(&cgwb_lock);
+	mutex_lock(&bdi->cgwb_release_mutex);
+	spin_lock_irq(&cgwb_lock);
 	while (!list_empty(&bdi->wb_list)) {
 		wb = list_first_entry(&bdi->wb_list, struct bdi_writeback,
 				      bdi_node);
 		spin_lock_irq(&cgwb_lock);
 	}
 	spin_unlock_irq(&cgwb_lock);
+	mutex_unlock(&bdi->cgwb_release_mutex);
 }
 /**